tocsin

CVE-2026-27893

2 advisories.

PyPI/vllm CVE-2026-27893: high 8.8

vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out

Action: Upgrade vllm to 0.18.0 or later.

pip install vllm==0.18.0

Affected

introducedfixedlast affected
0.10.10.18.0-

Fixed versions

0.18.0

Sources

CVE-2026-27893 · published · modified · JSON

PyPI/vllm CVE-2026-27893: high 8.8

vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode `trust_remote_code=True` when

Action: Upgrade vllm to 0.18.0 or later.

pip install vllm==0.18.0

Affected

introducedfixedlast affected
0.10.10.18.0-

Fixed versions

0.18.0

Sources

CVE-2026-27893 · published · modified · JSON